Is a legitimate interests assessment a legal requirement?

You must do the three-part test before relying on legitimate interests. The ICO says you should record your assessment and its outcome, though UK GDPR has no specific rule that you write it down. In practice, a written LIA is how you show your reasoning if anyone asks.

Do I need a separate LIA for every campaign?

No. You need one per distinct activity, such as cold B2B email, a customer newsletter or retargeting ads. Review it when the data, audience or channel changes, and at least once a year.

Can I use legitimate interests for cold email to sole traders?

Not on its own. PECR treats sole traders and some partnerships as individuals, so marketing email to them normally needs consent. Legitimate interests covers your use of the data, not the PECR rules for the channel.

What happens if someone objects to my marketing?

You must stop using their data for direct marketing. Under UK GDPR Article 21, the right to object to direct marketing has no balancing test, so add them to your suppression list and keep them there.

Is this template legal advice?

No. It is a general template to help you structure your assessment. If your data, audience or channels are unusual, or you are unsure, speak to a qualified data protection adviser.

Legitimate Interests Assessment (LIA) Template, Free

The short version

A legitimate interests assessment (LIA) records why you can rely on legitimate interests, the lawful basis in UK GDPR Article 6(1)(f), for a use of personal data such as B2B outreach.
It has three parts: a purpose test, a necessity test and a balancing test. You must pass all three.
Legitimate interests covers the data. PECR, the UK's rules on marketing email, still applies to the channel.
Download the free LIA template (Word, 6 pages), with a filled-in B2B email example.

What is a legitimate interests assessment?

A legitimate interests assessment is a short written record that shows you can rely on legitimate interests as your lawful basis for using personal data. Under UK GDPR Article 6(1)(f), you can use data when it is necessary for your legitimate interests, unless the person's interests or rights override them. The assessment is where you work that out.

The ICO says you should record your LIA and the outcome. The law does not strictly require a written record, but without one you cannot easily show your reasoning if someone complains or the ICO asks. For B2B outreach, where you contact people who have not signed up to hear from you, a written assessment is the normal standard.

Write one assessment per activity, not one for the whole company. For example:

Cold email to named contacts at target companies.
A newsletter to existing customers.
Retargeting ads to website visitors.

Review each one when the data, the audience or the channel changes, and at least once a year.

What is the legitimate interests three-part test?

The legitimate interests three-part test asks whether you have a real interest, whether using the data is necessary for it, and whether the person's rights outweigh it. The ICO sets out the three tests as purpose, necessity and balancing. Fail any one and you cannot rely on legitimate interests for that activity.

1. Purpose test

Name the interest and say who benefits. "To grow our business" is too vague on its own. "To tell finance leads at UK consultancies about software that automates their month-end reporting" is specific enough to test.

2. Necessity test

Show that this use of data actually serves the purpose, and that there is no less intrusive way to reach it. For outreach, that usually means using only the fields you need (name, work email, job title and company) and targeting relevant roles, not everyone at a company.

3. Balancing test

Look at it from the recipient's side. Would they reasonably expect a work email about something tied to their role? Is the data ordinary work contact data, or something more private? How often will you contact them, and how easy is it to say no? Your safeguards go here too.

How do you fill in a legitimate interests assessment for B2B email?

You fill in a legitimate interests assessment for B2B email by scoping the activity first, then answering each of the three tests in plain, specific language. The free template follows that order, in five parts:

Processing overview. The activity, the data fields, where the data came from, who it is about and which channels you use.
Purpose test. What you want to achieve, who benefits and what happens if you can't do it.
Necessity test. Data minimisation, retention period, list accuracy and how people opt out.
Balancing test. The nature of the data, the relationship, reasonable expectations, likely impact and a checklist of safeguards.
Outcome and sign-off. The result of each test, the final decision and a pre-launch checklist.

You also need to tell people where you got their details. When the data didn't come from them, UK GDPR expects you to say so by your first message at the latest, usually in a short line plus a link to your privacy notice.

Download the legitimate interests assessment template. It's a Word document you can edit, with guidance beside every question and a worked B2B email example at the end. It is a general template, not legal advice.

Legitimate interests assessment example: B2B email outreach

This example is the one at the end of the template, shortened. It shows the level of detail to aim for. Replace every line with your own facts.

Activity: a short introductory email to named contacts at consultancies about analytics software.
Purpose: finding new business customers, a legitimate commercial interest. Recipients may benefit from a tool relevant to their role.
Necessity: email is proportionate for B2B contact. Only name, work email, job title and company are used, and only for roles tied to the product.
Balancing: work contact details used for a relevant role are within reasonable expectations. The impact is low: a short sequence, no sensitive data and no profiling beyond job title.
Safeguards: an unsubscribe link in every email, a suppression list honoured within 24 hours, data from public business sources, and deletion after 12 months without engagement.
Outcome: all three tests passed. Proceed on legitimate interests and review in 12 months.

People can object to direct marketing at any time. Under UK GDPR Article 21(2) and (3), once someone objects, you must stop using their data for marketing. There is no balancing test for that, so your unsubscribe route has to work every time.

Does legitimate interests make cold email legal under PECR?

No. Legitimate interests is your lawful basis for using the data, but PECR sets separate rules for sending marketing email. Under the ICO's guidance on electronic mail marketing, you can email corporate bodies, such as limited companies and LLPs, without their consent. Individuals normally need to have consented.

Corporate subscribers (companies, LLPs, Scottish partnerships, government bodies): no consent needed for marketing email. Identify yourself and keep a list of anyone who asks not to be emailed.
Sole traders and some partnerships are treated as individuals, so the consent rules apply. Exclude them from cold outreach.
Existing customers may fall under the "soft opt-in" if you got their details in a sale or negotiation, market similar products, and offered an opt-out each time.

The ICO marks this guidance as under review following the Data (Use and Access) Act, so check it again before you rely on it. We checked these pages on 8 November 2026.

MagpieCRM finds B2B contacts from public sources and checks each work email with the company's mail server. Every campaign carries a one-click unsubscribe, and sequences stop for anyone who replies, unsubscribes or bounces. On Magpie Cloud, addresses that have bounced, complained or opted out are blocked from future sends. Those are safeguards you can name in the balancing test, but you still need your own assessment.

Legitimate interests assessment: a free template for B2B email